@robosystems/core 0.8.0 → 0.8.2

package/auth-components/SignInForm.d.ts

@@ -17,6 +17,20 @@ export interface SignInFormProps {
  * auth body) stays "Invalid email or password"; 5xx gets its own message.
  */
 export declare function loginErrorMessage(error: unknown): string;
+/**
+ * Message for a login that verified the password but did not mint a session.
+ *
+ * The backend interposes a passkey step between password check and session
+ * (`mfa_required` for an enrolled user, `mfa_enrollment_required` for a
+ * privileged one under enforcement). This form implements no such step, so
+ * the flow ends here — and it must end *visibly*. Navigating on a sessionless
+ * response drops the user on a protected route that bounces them straight
+ * back to the login page, an unexplained loop.
+ *
+ * Deployments that enable passkeys need a login surface that carries the
+ * ceremony through; see the platform app's `MfaChallenge`.
+ */
+export declare function mfaUnsupportedMessage(status?: string): string;
 /**
  * Messages for the `?reason=` a redirect into the login page can carry. The
  * producer is `AuthProvider`'s `logout(reason)`, which sends the user to

package/auth-components/SignInForm.js

@@ -26,6 +26,25 @@ export function loginErrorMessage(error) {
     }
     return 'Invalid email or password';
 }
+/**
+ * Message for a login that verified the password but did not mint a session.
+ *
+ * The backend interposes a passkey step between password check and session
+ * (`mfa_required` for an enrolled user, `mfa_enrollment_required` for a
+ * privileged one under enforcement). This form implements no such step, so
+ * the flow ends here — and it must end *visibly*. Navigating on a sessionless
+ * response drops the user on a protected route that bounces them straight
+ * back to the login page, an unexplained loop.
+ *
+ * Deployments that enable passkeys need a login surface that carries the
+ * ceremony through; see the platform app's `MfaChallenge`.
+ */
+export function mfaUnsupportedMessage(status) {
+    if (status === 'mfa_enrollment_required') {
+        return 'This account must enroll a passkey before signing in, which this sign-in page cannot complete.';
+    }
+    return 'This account requires passkey verification to sign in, which this sign-in page cannot complete.';
+}
 /**
  * Messages for the `?reason=` a redirect into the login page can carry. The
  * producer is `AuthProvider`'s `logout(reason)`, which sends the user to
@@ -125,6 +144,19 @@ export function SignInForm({ onSuccess, onRedirect, redirectTo = '/home', classN
         setError('');
         try {
             const result = await authClient.login(formData.email, formData.password);
+            // No session was minted — the backend is waiting on a passkey step this
+            // form cannot run. Stop here rather than redirecting into a route that
+            // will bounce straight back. `success` is false only for the MFA
+            // statuses; pre-MFA backends send no `status` and read as authenticated.
+            if (!result.success) {
+                if (process.env.NODE_ENV === 'development') {
+                    console.error(`[SignInForm] login returned "${result.status}" — this component does not implement the passkey step. ` +
+                        'Use a sign-in surface that completes the MFA ceremony.');
+                }
+                setError(mfaUnsupportedMessage(result.status));
+                setLoading(false);
+                return;
+            }
             // Call onSuccess callback if provided
             if (onSuccess) {
                 onSuccess(result.user);

package/auth-core/client.d.ts

@@ -87,11 +87,17 @@ export declare class RoboSystemsAuthClient {
     /** Passwordless login: assertion → session. */
     completePasskeyLogin(assertion: Record<string, unknown>): Promise<AuthResponse>;
     /**
-     * Begin enrollment. Authenticated settings flow omits `mfaToken`; the
-     * forced-enrollment lane passes the token from an
-     * `mfa_enrollment_required` login.
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
      */
-    getPasskeyRegistrationOptions(mfaToken?: string): Promise<Record<string, unknown>>;
+    getPasskeyRegistrationOptions(proof?: {
+        mfaToken?: string;
+        password?: string;
+        assertion?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
     /**
      * Finish enrollment. First passkey returns recovery codes (once); in the
      * forced-enrollment lane the result carries the completed login and the

package/auth-core/client.js

@@ -570,14 +570,20 @@ export class RoboSystemsAuthClient {
         return this.finalizeAuthResponse(response.data);
     }
     /**
-     * Begin enrollment. Authenticated settings flow omits `mfaToken`; the
-     * forced-enrollment lane passes the token from an
-     * `mfa_enrollment_required` login.
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
      */
-    async getPasskeyRegistrationOptions(mfaToken) {
+    async getPasskeyRegistrationOptions(proof) {
         const response = await getPasskeyRegistrationOptions({
             client: this.client,
-            body: { mfa_token: mfaToken },
+            body: {
+                mfa_token: proof === null || proof === void 0 ? void 0 : proof.mfaToken,
+                password: proof === null || proof === void 0 ? void 0 : proof.password,
+                assertion: proof === null || proof === void 0 ? void 0 : proof.assertion,
+            },
         });
         return response.data.options;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,